DFARS - Revision history

Marieramsay at 22:55, 26 September 2024

2024-09-26T22:55:27Z

← Older revision		Revision as of 22:55, 26 September 2024
Line 1:		Line 1:
	Several Defense Federal Acquisition Regulation Supplement (DFARS) clauses are directly related to CMMC (Cybersecurity Maturity Model Certification) and the protection of Controlled Unclassified Information (CUI).		Several [https://www.acquisition.gov/dfars Defense Federal Acquisition Regulation Supplement] (DFARS) clauses are directly related to CMMC (Cybersecurity Maturity Model Certification) and the protection of Controlled Unclassified Information (CUI).

	These DFARS clauses mandate that contractors meet certain cybersecurity requirements and, in some cases, obtain CMMC certification. Here are the most relevant DFARS clauses:		These DFARS clauses mandate that contractors meet certain cybersecurity requirements and, in some cases, obtain CMMC certification. Here are the most relevant DFARS clauses:

Marieramsay at 22:54, 26 September 2024

2024-09-26T22:54:52Z

← Older revision		Revision as of 22:54, 26 September 2024
Line 3:		Line 3:
	These DFARS clauses mandate that contractors meet certain cybersecurity requirements and, in some cases, obtain CMMC certification. Here are the most relevant DFARS clauses:		These DFARS clauses mandate that contractors meet certain cybersecurity requirements and, in some cases, obtain CMMC certification. Here are the most relevant DFARS clauses:

	1. [https://www.acquisition.gov/dfars/252.204-7012-safeguarding-covered-defense-information-and-cyber-incident-reporting. DFARS 252.204-7012 – Safeguarding Covered Defense Information and Cyber Incident Reporting]		1. [https://www.acquisition.gov/dfars/252.204-7012-safeguarding-covered-defense-information-and-cyber-incident-reporting. DFARS 252.204-7012] – Safeguarding Covered Defense Information and Cyber Incident Reporting

	This clause requires defense contractors to provide "adequate security" for covered defense information (CDI), including CUI, by implementing NIST SP 800-171 security requirements.		This clause requires defense contractors to provide "adequate security" for covered defense information (CDI), including CUI, by implementing NIST SP 800-171 security requirements.

Marieramsay: Created page with "Several Defense Federal Acquisition Regulation Supplement (DFARS) clauses are directly related to CMMC (Cybersecurity Maturity Model Certification) and the protection of Controlled Unclassified Information (CUI). These DFARS clauses mandate that contractors meet certain cybersecurity requirements and, in some cases, obtain CMMC certification. Here are the most relevant DFARS clauses: 1. [https://www.acquisition.gov/dfars/252.204-7012-safeguarding-covered-defense-inform..."

2024-09-26T22:54:40Z

Created page with "Several Defense Federal Acquisition Regulation Supplement (DFARS) clauses are directly related to CMMC (Cybersecurity Maturity Model Certification) and the protection of Controlled Unclassified Information (CUI). These DFARS clauses mandate that contractors meet certain cybersecurity requirements and, in some cases, obtain CMMC certification. Here are the most relevant DFARS clauses: 1. [https://www.acquisition.gov/dfars/252.204-7012-safeguarding-covered-defense-inform..."

New page

Several Defense Federal Acquisition Regulation Supplement (DFARS) clauses are directly related to CMMC (Cybersecurity Maturity Model Certification) and the protection of Controlled Unclassified Information (CUI).

These DFARS clauses mandate that contractors meet certain cybersecurity requirements and, in some cases, obtain CMMC certification. Here are the most relevant DFARS clauses:

1. [https://www.acquisition.gov/dfars/252.204-7012-safeguarding-covered-defense-information-and-cyber-incident-reporting. DFARS 252.204-7012 – Safeguarding Covered Defense Information and Cyber Incident Reporting]

This clause requires defense contractors to provide "adequate security" for covered defense information (CDI), including CUI, by implementing NIST SP 800-171 security requirements.

It also mandates that contractors report cyber incidents to the DoD and includes the requirement to flow these obligations down to subcontractors handling CDI.

While this clause does not explicitly require CMMC, compliance with NIST SP 800-171 forms the foundation for CMMC Level 2.

2. [https://www.acquisition.gov/dfars/252.204-7019-notice-nistsp-800-171-dod-assessment-requirements. DFARS 252.204-7019] – Notice of NIST SP 800-171 DoD Assessment Requirements

This clause mandates that contractors conduct a self-assessment against the 110 security requirements of NIST SP 800-171, scoring their compliance and uploading the results to the Supplier Performance Risk System ([[SPRS]]).

Contractors must conduct this self-assessment as a prerequisite for contract awards, and the results are used in part to assess the contractor's cybersecurity readiness, which ties into CMMC certification.

3. [https://www.acquisition.gov/dfars/252.204-7020-nist-sp-800-171dod-assessment-requirements. DFARS 252.204-7020] – NIST SP 800-171 DoD Assessment Requirements

This clause requires that the DoD or its authorized third-party assessors conduct assessments of the contractor’s compliance with NIST SP 800-171. This assessment could be a Basic, Medium, or High level, depending on the nature of the contract.

This clause is a step towards ensuring contractors meet the requirements of CMMC Level 2, which is built on NIST SP 800-171 Rev 2.

4. [https://www.ecfr.gov/current/title-48/chapter-2/subchapter-H/part-252/subpart-252.2/section-252.204-7021 DFARS 252.204-7021] – CMMC Requirements

This clause is specific to CMMC and requires that defense contractors achieve the appropriate CMMC certification level for the contract they are bidding on.

The CMMC level required will depend on the type of information handled (e.g., FCI or CUI). Certification must be verified by a CMMC Third-Party Assessment Organization (C3PAO) before contract award.

This clause also requires that CMMC compliance flow down to any subcontractors involved in the contract who handle CUI or FCI.

These DFARS clauses establish the foundation for cybersecurity compliance, with DFARS 252.204-7021 being the core clause specific to CMMC certification requirements.